File name:

cf9e75cab8d6e3b77258c937554d9b33c3b51395099219925048fda93f2eb261

Full analysis: https://app.any.run/tasks/ccbfbab0-c8fd-4d0d-b684-5a1d89fe4cd2
Verdict: Malicious activity
Analysis date: March 21, 2019, 03:13:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
macros
macros-on-open
Indicators:
MIME: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info: Microsoft Excel 2007+
MD5:

2569459D07B891B094E8FE0D3C406F78

SHA1:

6B05A57CC778B3A09C30AFD0F79E483538EBACF7

SHA256:

CF9E75CAB8D6E3B77258C937554D9B33C3B51395099219925048FDA93F2EB261

SSDEEP:

98304:A7+g9Kou/+0RxsU1ZhAaJysG635+RiJgs4sQUPjR56x886GAki:2+OG2axDXGkgsJrS6b

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Unusual connect from Microsoft Office

      • EXCEL.EXE (PID: 1624)

    • Reads internet explorer settings

      • EXCEL.EXE (PID: 1624)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 1624)
      • EXCEL.EXE (PID: 3320)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 1624)
      • iexplore.exe (PID: 3244)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3244)
      • iexplore.exe (PID: 3568)
      • iexplore.exe (PID: 1452)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3244)
      • iexplore.exe (PID: 3568)
      • iexplore.exe (PID: 1452)

    • Reads settings of System Certificates

      • EXCEL.EXE (PID: 1624)
      • iexplore.exe (PID: 3020)

    • Changes internet zones settings

      • iexplore.exe (PID: 3020)

    • Application launched itself

      • iexplore.exe (PID: 3020)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3020)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xlam | Excel Macro-enabled Open XML add-in (39.7)
.xlsm | Excel Microsoft Office Open XML Format document (with Macro) (27.3)
.xlsx | Excel Microsoft Office Open XML Format document (16.1)
.zip | Open Packaging Conventions container (8.3)
.zan | BlueEyes Animation (6.4)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0x8f93cb55
ZipCompressedSize: 470
ZipUncompressedSize: 1880
ZipFileName: [Content_Types].xml

XML

TotalEditTime: -
Application: Microsoft Excel
DocSecurity: None
ScaleCrop: No
HeadingPairs:
  • listy
  • 1
  • Pojmenované oblasti
  • 8
TitlesOfParts:
  • Nabidka
  • CSY
  • další
  • ENU
  • MOCS
  • Nabidka!Oblast_tisku
  • Parametry
  • PCS
  • PLK
Company: -
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
AppVersion: 16.03
PicturePath: p:\preview\small
LastModifiedBy: Pekárek Milan
LastPrinted: 2017:04:20 06:36:51Z
CreateDate: 2004:06:02 07:00:40Z
ModifyDate: 2019:03:19 10:50:02Z
Category: Verze 21.6.2017

XMP

Title: -
Creator: Ladislav Koutník
Description: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe no specs excel.exe iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1452"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3020 CREDAT:6403C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1624"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\excel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3020"C:\Program Files\Internet Explorer\iexplore.exe" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3244"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3020 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3320"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\excel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3568"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3020 CREDAT:6402C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 912
Read events
2 670
Write events
222
Delete events
20

Modification events

(PID) Process:(3320) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:o =
Value:
6F203D00F80C0000010000000000000000000000
(PID) Process:(3320) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3320) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3320) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
Operation:writeName:MTTT
Value:
F80C0000F85F992394DFD40100000000
(PID) Process:(3320) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:delete valueName:o =
Value:
6F203D00F80C0000010000000000000000000000
(PID) Process:(3320) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:delete keyName:
Value:
(PID) Process:(3320) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency
Operation:delete keyName:
Value:
(PID) Process:(3320) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3320) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3320) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\F96F8
Operation:writeName:F96F8
Value:
04000000F80C00005C00000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C0063006600390065003700350063006100620038006400360065003300620037003700320035003800630039003300370035003500340064003900620033003300630033006200350031003300390035003000390039003200310039003900320035003000340038006600640061003900330066003200650062003200360031002E0078006C0061006D00000000001700000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C0001000000000000009003C12494DFD401F8960F00F8960F0000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
0
Suspicious files
10
Text files
17
Unknown types
10

Dropped files

PID
Process
Filename
Type
3320EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR906F.tmp.cvr —
MD5:—
SHA256:—
3320EXCEL.EXEC:\Users\admin\Desktop\~$cf9e75cab8d6e3b77258c937554d9b33c3b51395099219925048fda93f2eb261.xlam —
MD5:—
SHA256:—
1624EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVREE9D.tmp.cvr —
MD5:—
SHA256:—
1624EXCEL.EXEC:\Users\admin\AppData\Local\Temp\Cab763C.tmp —
MD5:—
SHA256:—
1624EXCEL.EXEC:\Users\admin\AppData\Local\Temp\Tar763D.tmp —
MD5:—
SHA256:—
1624EXCEL.EXEC:\Users\admin\AppData\Local\Temp\Cab764E.tmp —
MD5:—
SHA256:—
1624EXCEL.EXEC:\Users\admin\AppData\Local\Temp\Tar764F.tmp —
MD5:—
SHA256:—
1624EXCEL.EXEC:\Users\admin\AppData\Local\Temp\Cab76FC.tmp —
MD5:—
SHA256:—
1624EXCEL.EXEC:\Users\admin\AppData\Local\Temp\Tar76FD.tmp —
MD5:—
SHA256:—
3020iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\favicon[1].ico —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
14
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1624
EXCEL.EXE
GET
301
212.65.245.203:80
http://www.vetroplus.cz/produkty/50102101.jpg
CZ
html
168 b
unknown
1624
EXCEL.EXE
GET
301
212.65.245.251:80
http://www.vetroshop.cz/produkty/50102101.jpg
CZ
html
256 b
unknown
1624
EXCEL.EXE
GET
301
212.65.245.203:80
http://www.vetroplus.cz/produkty/50102101.jpg
CZ
html
168 b
unknown
1624
EXCEL.EXE
GET
301
212.65.245.203:80
http://www.vetroplus.cz/produkty/50102101.jpg
CZ
html
168 b
unknown
1624
EXCEL.EXE
GET
301
212.65.245.203:80
http://www.vetroplus.cz/produkty/50102101.jpg
CZ
html
168 b
unknown
1624
EXCEL.EXE
GET
301
212.65.245.203:80
http://www.vetroplus.cz/produkty/50102101.jpg
CZ
html
168 b
unknown
1624
EXCEL.EXE
GET
301
212.65.245.251:80
http://www.vetroshop.cz/produkty/50102101.jpg
CZ
html
256 b
unknown
1624
EXCEL.EXE
GET
301
212.65.245.251:80
http://www.vetroshop.cz/produkty/50102101.jpg
CZ
html
256 b
unknown
1624
EXCEL.EXE
GET
301
212.65.245.251:80
http://www.vetroshop.cz/produkty/5052100b.jpg
CZ
html
256 b
unknown
1624
EXCEL.EXE
GET
301
212.65.245.203:80
http://www.vetroplus.cz/produkty/5052100b.jpg
CZ
html
168 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3568
iexplore.exe
212.65.245.251:443
www.vetroshop.cz
T-Mobile Czech Republic a.s.
CZ
unknown
1452
iexplore.exe
212.65.245.251:443
www.vetroshop.cz
T-Mobile Czech Republic a.s.
CZ
unknown
1624
EXCEL.EXE
212.65.245.203:80
www.vetroplus.cz
T-Mobile Czech Republic a.s.
CZ
unknown
1624
EXCEL.EXE
212.65.245.251:80
www.vetroshop.cz
T-Mobile Czech Republic a.s.
CZ
unknown
1624
EXCEL.EXE
212.65.245.251:443
www.vetroshop.cz
T-Mobile Czech Republic a.s.
CZ
unknown
1624
EXCEL.EXE
23.111.11.204:80
repository.certum.pl
netDNA
US
unknown
1624
EXCEL.EXE
2.16.186.81:80
www.download.windowsupdate.com
Akamai International B.V.
—
whitelisted
3020
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3020
iexplore.exe
212.65.245.251:443
www.vetroshop.cz
T-Mobile Czech Republic a.s.
CZ
unknown

DNS requests

Domain
IP
Reputation
www.vetroplus.cz
  • 212.65.245.203
unknown
www.vetroshop.cz
  • 212.65.245.251
unknown
repository.certum.pl
  • 23.111.11.204
whitelisted
www.download.windowsupdate.com
  • 2.16.186.81
  • 2.16.186.56
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cf9e75cab8d6e3b77258c937554d9b33c3b51395099219925048fda93f2eb261